Information on the handling of your data
An obligation arising from the General Data Protection Regulation.
1. preliminary remark
The following points are intended to provide you with information about your data. The legislator has determined which information is necessary for this.
Anyone who wants to know more about this can find it in the General Data Protection Regulation in Articles 12 to 22 and 34. The text of the General Data Protection Regulation is available on the Internet at https://dsgvo-gesetz.de/. If you have any further questions about the General Data Protection Regulation, you can contact the data protection officer and/or the administration at any time.
2. what is personal data?
All information relating to an identified or identifiable person. A person is identifiable if he or she can be identified directly or indirectly. This can be done, for example, by assigning an identifier such as a name, an identification number, location data, an online identifier or one or more special features.
3. basic information
3.1 Who is responsible for processing my data?
The person responsible for data processing is
Consult-SK Ltd.
Simeonsplatz 2
32423 Minden
Phone: +49 (571) 7834350
E-mail: datenschutz@consult-sk.de
3.2 How can I contact you?
Contact person: Mr. Marc Schütte
E-mail: datenschutz@consult-sk.de
3.3 Which authority is responsible for control and compliance with data protection law?
Competent data protection supervisory authority
State Commissioner for Data Protection and Freedom of Information
North Rhine-Westphalia
PO Box 20 04 44
40102 Düsseldorf
Phone: +49 (211) 38424-0
Fax: +49 (211) 38424-10
E-mail: poststelle@ldi.nrw.de
3.4 How can I contact the company's data protection officer?
The data protection officer can be reached as follows:
Carsten Bruns,
SK-Consulting Group GmbH
Easter road 2
32549 Bad Oeynhausen
Email: datenschutz@SK-consulting.com.
4. other important information
4.1 Data processing (Why?)
We process your data to fulfill mutual obligations arising from the contractual relationship (which may be in the process of being established) or to fulfill legal obligations.
4.2 Why may we do this?
Data protection law allows us (pursuant to Article 6 (1) sentence 1 lit. b DSGVO) to process data that is necessary for the performance of a contract or for the implementation of pre-contractual measures. If you voluntarily provide us with things about yourself that go beyond what is necessary, data protection law allows us to do so in the context of consent (pursuant to Article 6 (1) sentence 1 lit. a DSGVO). Data protection law allows us in Art. 6 para. 1 sentence 1 lit. c DSGVO to process your data if there is a legal obligation to do so.
4.3 Who can receive data from me?
As part of the processing, your data may be transmitted to:
Persons within our company who are directly involved in data processing (e.g. sales, purchasing)
Service providers who are contractually bound and obligated to maintain confidentiality and who perform partial data processing tasks, as well as other external bodies (companies, authorities, etc.) if this is necessary.
4.4 Will you transfer data from me to countries outside the European Union?
This is not planned by us. An exception to this would only be conceivable if you would initiate this or if this would be necessary for the fulfillment of the contract. Legal basis: Article 6 (1) sentence 1 lit. b DSGVO, Article 49 (1) lit. b DSGVO.
4.5 How long will you store my data?
We store your data for the time we need it to achieve the purposes set out in 4.1 above. However, there are legal regulations (e.g. the German Fiscal Code § 147) that require us to retain certain documents for six or ten years. After the retention period has expired, we delete data that is no longer required.
4.6 Do I have to provide my data?
In order to achieve the reasons outlined in point 4.1, it is necessary for you to provide us with your personal data for our pleasure.
For the fulfillment of the contract with you, this is mandatory or required by law. In case of non-provision we cannot fulfill the contract with you.
4.7 Automated decision making / profiling
Automatic decision making / profling does not take place.
5. what rights do i have?
5.1 Note on your rights
As a data subject of a data processing operation, you have, among others, the following rights under the General Data Protection Regulation (hereinafter also referred to as "data subject rights"):
5.2 Rights of access (according to Article 15 GDPR)
You have the right to request information about whether or not we are processing personal data relating to you. If we process personal data about you, you have the right to know,
- why we process your data (see also point 4.1);
- what types of data we process from you;
- which type of recipients receive or should receive data from you (see also point 4.3);
- how long we will store your data; if it is not possible to specify the storage period, we must state how the storage period is determined (e.g. after the expiry of statutory retention periods) (see also point 4.5);
- that you have a right to rectification and erasure of the data concerning you, including the right to restrict processing and/or the possibility to object (see also points 5.2, 5.3 and following);
- that you have a right of appeal to a supervisory authority;
- where your data comes from, if we have not collected it directly from you;
- whether your data is used for an automated decision and, if so, to learn which logic underlies the decision and what effects and scope the automated decision may have for you;
- that if data about you is transferred to a country outside the European Union, you have the right to be informed whether and, if so, on the basis of which guarantees an adequate level of protection is ensured at the data recipient;
- that you have the right to request a copy of their personal data. Copies of data are always provided in electronic form.
The first copy is free of charge; a reasonable fee may be charged for additional copies. A copy may only be provided insofar as the rights of other persons are not impaired thereby.
5.3 Right to rectify the data (according to Article 16 DSGVO)
You have the right to request that we correct your data if it is incorrect and/or incomplete. This right also includes the right to completion through supplementary statements or notifications. A correction and/or completion must be made without culpable hesitation.
5.4 Right to erasure of personal data (according to article 17 DSGVO)
You have the right to request that we delete your personal data if
the personal data are no longer necessary for the purposes for which they were collected and processed;
the data processing is carried out on the basis of consent given by you and you have revoked the consent; however, this does not apply if another legal permission for the data processing exists;
you have objected to data processing whose legal permission is in the so-called "legitimate interest" (according to Article 6(1)(e) or (f)); however, erasure need not take place if there are overriding legitimate grounds for further processing;
you have objected to data processing for the purpose of direct marketing;
your personal data have been processed unlawfully;
it is data of a child collected for information society services (=electronic service) on the basis of consent (pursuant to Art. 8 (1) GDPR).
A right to delete personal data does not exist if
- the right to freedom of expression and information precludes the request for deletion;
- the processing of personal data
- to fulfill a legal obligation (e.g. legal retention obligations),
- for the performance of public duties and interests under applicable law (this includes "public health"), or
- is required for archiving and/or research purposes;
the personal data is necessary for the assertion, exercise or defense of legal claims.
The deletion must take place immediately (without culpable delay). If personal data has been made public by us (e.g. on the Internet), we must ensure, as far as is technically possible and reasonable, that other data processors are also informed of the deletion request, including the deletion of links, copies and/or replications.
5.5 Right to restriction of data processing (according to Article 18 DSGVO)
You have the right to have the processing of your personal data restricted in the following cases:
If you dispute the accuracy of your personal data, you may request that we do not use your data for any other purpose for the duration of the verification of the accuracy and thus restrict its processing.
In the event of unlawful data processing, you may request restriction of data use instead of data deletion;
If you need their personal data for the assertion, exercise or defense of legal claims, but we no longer need their personal data, you can require us to restrict processing to the law enforcement purposes;
If you have objected to data processing (pursuant to Art. 21 (1) DSGVO) (see also point 5.7) and it is not yet clear whether our interests in processing outweigh your interests, you may request that your data not be used for other purposes for the duration of the review and thus that its processing be restricted.
Personal data, the processing of which has been restricted at their request, may - subject to storage - only be
with their consent,
for the assertion, exercise or defense of legal claims,
to protect the rights of other natural or legal persons, or
processed for reasons of important public interest.
In the event that a processing restriction is lifted, they will be informed of this in advance.
5.6 Right to data portability (according to Article 20 DSGVO)
You have the right to request the data you have provided to us in a common electronic format (e.g. as a PDF or Excel document).
You may also request us to transfer this data directly to another (by specified) company, if this is technically possible for us.
The condition for you to have this right is that the processing is carried out by on the basis of consent or for the performance of a contract and is carried out with the help of automated processes.
The exercise of the right to data portability does not affect the rights and freedoms of other persons
If you use the right to data portability, you still have the right to data erasure according to Article 17 DSGVO.
5.7 Right to object to certain data processing (according to Article 21 GDPR)
If your data is processed for the performance of tasks in the public interest or for the performance of legitimate interests, you may object to this processing. To do so, you must provide us with the reasons arising from your particular situation for your objection. These may be, for example, special family circumstances or confidentiality interests worthy of protection.
In the event of objection, we shall refrain from any further processing of their data for the aforementioned purposes, unless,
there are compelling legitimate grounds for processing which override their interests, rights and freedoms, or
the processing is necessary for the establishment, exercise or defense of legal claims.
You may object to the use of your data for direct marketing purposes at any time; this also applies to profiling insofar as it is connected with direct marketing. In the event of an objection, we may no longer use your data for the purpose of direct advertising.
5.8 Prohibition of automated decisions/profiling (according to Article 22 GDPR)
Decisions by us that have legal consequences for you or significantly affect you must not be based solely on automated processing of personal data. This also includes profiling. This prohibition does not apply insofar as the automated decision
is necessary for the conclusion or fulfillment of a contract with you,
is permitted by law, if these legal documents contain appropriate measures to protect your rights and freedoms as well as your legitimate interests, or
is done with their express consent.
Decisions based exclusively on automated processing special categories of personal data (=sensitive data) are only permissible if they are based on
be made with your express consent or
there is a substantial public interest in the processing
and appropriate measures have been taken to protect your rights and freedoms and your legitimate interests.
5.9 Exercise of data subject rights
To exercise the data subject rights, please contact the office mentioned under point 3.2. Requests submitted electronically will generally be answered electronically. The information, notifications and measures to be provided in accordance with the GDPR, including "the exercise of data subject rights, are generally provided free of charge. Only in the case of manifestly unfounded or excessive requests are we entitled to charge an appropriate fee for processing or to refrain from taking action (pursuant to Article 12(5) of the GDPR).
If there is reasonable doubt about your identity, we may request additional information from you for identification purposes. If we are unable to identify you, we are entitled to refuse to process your request. If we are unable to identify you, we will notify you separately, where possible. (see Article 12(6) and Article 11 DSGVO).
As a rule, requests for information will be processed without delay, within one month of receipt of the request. The deadline may be extended by a further two months if this is necessary, taking into account the complexity and/or number of requests; in the event of an extension of the deadline, we will inform you of the reasons for the delay within one month of receipt of your request. If we fail to act on a request, we will promptly inform you of the reasons within one month of receipt of the request and inform you of the possibility to lodge a complaint with a supervisory authority or to seek judicial remedy. (see Article 12(3) and (4) GDPR).
Please note that you may exercise your data protection rights only within the limits of restrictions and limitations provided for by the Union or the Member States. (Article 23 GDPR)